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Description 

BACKGROUND OF THE INVENTION 



[0001 ] Digrtal watermarking is a technique to insert a 
digital dentifier into an image so that the identifier can 
be extracted for the purposes of ownftrRhrp vertficatiffn 
.and/or authent cation. By ownership verification, we 
mean that we can extract a digital kientifier from a 
watermarked image that can be identified as being 
associated with a owner. A uthentication refers to the 
fact that we c an detect anv channe to the watf^rmarkpH 
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imaofi- Digital watermarking is becoming increasingly 
important due to the popularity of the usage of digital 
images on the worW wkle web and in electronic com- 
merce. 

[0002] From the oefspective of an image v iewer 
watermarks can be classified intc ^o categoriesj)^isible 
and invisible . Visible watermarking refers to the class of 
watermarking procedures where a visible stamp, e.g., a 
company logo, is inserted into an image. The stamp is 
visit)le in similar fashion as the watermark to current 
U.S. dollar bills. U.S. Patent No. 5.530.759, entitled 
"Color Con^ect Digital Watermarking of Images," to 
Braudaway et al. descrit>es a method of inserting a visi- 
ble watermark Into an original digital image. Braudaway 
et al. teaches mocfifying the Ixightness or darkness of 

^the original image based on the position of the water- 

\^ mark. The watermark insertion and extraction metfxxl- 
\ ology described in Braudaway et al. includes a random 
\ noise component which increases the drffrculty of 
1 removal of tiie watermark from the original image by 

\ anyone except the authorized user. 

[0003] An invisible wfatermark is a digital identifier 
added to a digrtal image so that the resulting image is 
visibly indistinguishable from the original unmarked 
image. The invisible signature can be extracted or 
detected through a sequence of image processing oper- 
ations on the digrtal image. The article "Secure Spread 
Spectrum Watermarking for Multimedia," Tech. Rep. 95- 
10, NEC Research Institute, 1995 by I. J. Cox, J. Kilian, 
T Leighton, and T Shamoon, descritjes a method of 
inserting an invisible watermark into a digital image. The 
Cox article describes transformation of an original 
image into a frequency domain representation of the 
image. From the frequency transformed representation 
of the image, the method descril>ed in Cox picks N fre- 
quency components of the image that are visually 
important and inserts a watermarking signal into these 
frequency components of tiie original image as a water- 
mark. 

V [0004] One way to accorrplish ownership verification 
I is to associate a user key wrtti a watermark so that the 
I desired v^^termark can only be exto-acted from a water- 
^^jiarked image witfi the appropriate user key. Two con- 

vpntional watprmarkinqmethodoiogies include: (1) 
<!Isecret key^w atermarking ^^l^hat requires that botti the 

owner and receiver possess the same seaet key and 
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((2)public key v>aternriarking^ hat requires the use of two 
different keys: a private key. and a coresponding public 
key. The private key is known only to the owner. The 
public key need not be seaet and Is used by tiie 
receiver of the image to detect the watermark A prob- 
lem with secret key watermarking is that key exchange 
must occur before the actual transmission, typteally via 
a wore expensive secret alternative path, or must be 
arranged when sender and receiver are proximate. 
[0005] In the article "An invisible watermarking tech- 
nk^ue for image verification.", M.M. Yeung and F Mint- 
zer, Proceedings of ICIP (Santa Bart>ara, CA). October 
1997, an authentication watermarking method is 
descril>ed for a secret key system. In tiie method 
desCTibed in ttie Yeung article, a secret key is used in 
combination witti a random number generator to gener- 
ate a look up table. The look up table defines a water- 
mark extraction orocedure . whk^ in turn suggests a 
watermark i nsertion step through adjustments to the 
original image. In the watermark extractkxi step, tiie 
extracted watermark is compared to a known water- 
mark to determine if the original image has been modi- 
fied. Although, the technique described by Yeung can 
detect changes to the pixel values of a watermarked 
image, it does not detect cfianges in image size result- 
ing from CTopping or certain scaling algoritfims. 
[0006] A metfKXI of invisible watermarking that can be^ 
used both for purposes of ownership verrfcation and 
authentication, tfiat can detect changes in pixel values 
as welt as image size, and that may be used in public 
key or alternatively, secret key watermarking systems is 
needed. 

SUMMARY OF THE INVENTION 

[0007] The present invention provWes an invisible dig- 
ital watermarking technique ttiat can serve the two pur- 
poses of ownership verification and authentication, that 
can detect cfianges in pixel values as well as image 
size, and that may be used in public key or alternatively, 
secret key watermarking systems. The present inven- 
tion includes a watermarit insertion procedure used by 
the image owner arxl a corresponding extraction proce- 
dure used by the receiver of the image. The watemnark 
insertion procedure conrputes a hash function of a mod- 
ified image block, a key and various image parameters, 
and then combines tiie hashed output with a block of 
the watermark bitmap, resulting in a comt>ined image 
btock. In the preferred emlxxliment, the modified image 
btock is the original image block witii its LSB's set to 
zero. As a final step to create a watermarked image 
block, the combined image block is inserted into a LSB 
of the modified image. 

[0008] The watermark extraction procedure takes tiie 
watermarked image block and creates two different 
image blocks: a first image block witfi the LSB's of tiie 
watermarked image tjlock set to zero, and a second 
image block with the LSB's of the watermarked image 
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' block extracted. The first image block, a key and various 
image parameters are used as inputs to the hash func- 
tion. Although the inputs to the hash function for the 
watermark extraction process are cfifferent than the 
inputs to the hash function for the watermark insertion 
^. process, the cryptographic hash functions used for both 
c^watermark insertion and extraction must be kientical. If 
^ the hash functions are different, the watennark will not 
/ be able to be properly extracted and the extracted 
watermark image will appear as noise. 
[0009] The watermark extraction procedure uses the 
hash function to calculate a diflfgtjlvglu^ , resulting in 
a hashed output. The hashed output is combined with 
the second image block, preferably using an exclusive 
OR function. The result of the conf±)ined hashed output 
with the second image block is a block of the extracted 
watermark. 

[001 0] The previously described insertion and extrac- 
tion rnethodotogy may be used forsecreH 
where the same secret key is used for both watermark 
insertion and extraction. In an alternative embodiment, 
the methodotogy described is nrxxJif ied so that the integ- 
rity and ownership of the image can be verified using a 
public key. In this alternative embodiment, a pMic key 
encryption step is included after the step combining of 
the hashed fmction with the watermark bitmap for the 
watermark insertion procedure. In addition, for tiie 
watermark extraction procedure, a pufcilic key decryption 
step is included before the extraction of the watermark 
using the reversit>le exclusive OR togic function. In such 
a system, the owner of the image inserts a watermark 
using a private key K', In the walernrark extraction pro- 
cedure, any person can use the puWk; key K (corre- 
sponding to the private key K") to extract a binary 
watermark, that will indicate any changes that have 
been made to the watermarked image. 
[0011] The present invention provides autherrtication 
t hat detecte any change to the watermarked image l or 

pJbo|h a secret key and pifclic kev w atermarking system . 
Detection of change is inportant for example where an 
image is to be used as evidence for l egal purpos es and 
in electronic commerce of images, where the txjyer of 
an image can be assured that no cfiange to the image 
has occurred when the image is delivered from the 

^seller to the buyer. If any part of the im age i s changed , 
the watermark extraction procedure, according to the 
present invention, will ret urn an output that indicates th e 
specHk; parts of tiie image tiiat have been changed . If a 
watermarked image is cropped, then the extraction pro- 
cedure will also return an output that resembles random 
noise, signifying the cropped image is not valid. 
[0012] A further underslancfing of the nature and 
advantages of tiie present invention may be realized 
witii reference to tiie remaining portions of the specifica- 
tion and the attached drawings. 



BRIEF DESCRIPTION OF THE DRAWINGS 
[0013] 

5 Rgure 1 A shows a block diagram of the watermark 
insertion methodology according to a first embodi- 
ment of the present invention. 

Rgure IB shows a flowchart of the steps cone- 
10 spending to the insertion methodology shown in 
Rgure 1A. 

Rgure 1C shows alternatives to step 152 of Rgure 
1 B (modifying tiie image block X^) 

15 

Rgure 2A shows a block diagram of the watermark 
extraction niethodofogy that is used in combination 
witii the insertion melhoddogy shown in Rgures 
1A. IB. and 10. 

20 

Rgure 2B shows a flowchart of the watermark 
extraction procedure that is used in combination 
with the insertion methodology shown in Rgures 
1A, IB. and 10. 

25 

Rgure 3 shows an original image before watermark 
insertion. 

Rgure 4 shows an image watermarked using the 
30 watermark insertion methodologies described in 
Rgures lAand IB. 

Rgure 5 shows the extracted watermark output 
image after application of the watermark exti-action 
35 procedure of Figures 2A and 2B when a con-ect 
user key K is used. 

Rgure 6 shows an extracted watermark output 
image resembling random noise ttiat may occur for 
40 example, if an image is unmarked, an inconrect key 
is applied, or the original image is cropped. 

Rgure 7 shows the watermarked image of Rgure 4 
tiiat has been modified by the inclusion of a glass. 

45 

Rgure 8 shows ttie extracted watermark from Rg- 
ure 7 indicating the specific area where the nxxlif i- 
cation to the watermarked image (the addition of a 
glass) have been made. 

50 

Rgure 9A shows a l^ock diagram of the watermark 
insertion methodology according to a second 
emtxxliment that inplements a public key system. 

55 Rgure 9B shows a flowchart of the steps corre- 
sponding to the insertion methodology shown in 
Rgure 9A. 
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Figure 10A shows a block diagram of the water- 
mark extraction methodology that is used In combi- 
nation with the insertion methodok)gy shown in 
Figures 9A and 9B. 

5 

Figure 10B shows a block diagram of the water- 
mark extraction methodology that is used in combi- 
nation with the insertion methoclok>gy shown in 
Rgure 9A and 9B. 

10 

Figure 11 shows a summary of the experimental 
results summarizing the properties of the seaet 
key verification methodology shown in Rgures 1A 
and IB. 

15 

Figure 12 shows a summary of the experimental 
results sunvnarizing the properties of the put)lic 
key verification metfKxJology shown in Rgures 9A 
and 9B. 

20 

Figure 13 shows a high-level block diagram of a 
computer system adapted to execute a software 
program implementing the steps of the watermark 
insertion metiiodology according to the present 
invention. 25 

DETAILED DESCRIPTION OF THE PREFERRED 
EMBODIMENTS 

[001 4] The present invention provides a technique for 30 
embedding and extracting a digital kientifier into an 
inrage „ di M x N pixels, to form a watermarked 
image Y;„,n of the same size. Figures 1A arxi IB show 
a watermark insertion methodology according to a first 
embodiment of the invention. Figures 2A arxJ 2B show a 35 
watermark extraction metfKxiology according to a first 
embodiment of the invention. The waternnark extraction 
methodology shown in Figures 2A arxl 26 shouki be 
used in corijurx;tk}n with the watermark insertion meth- 
odologies shown in Rgures 1 A and IB. 40 
[0015] Refening to the block diagram in Rgure 1A, 
sfiows a block dia^am for implementing the watermark 
insertion procedure. Figure IB shows a flowchart of the 
steps corresponding to the insertion methodology 
shown in Rgure 1A. Referring to Figure 1 A, an appara- 45 
tus 100 for implementing the insertion of a watermark 
into an original input digital image according to the 
present invention would include: a means for nxxjifying 
1 10 at least one predetermined bit in an image t)lock Xp 
wherein the modified image block is X^; a means for cal- so 
culating a digest of values 112 usir>g a cryptographic 
hash function, wherein the means for calculating a 
digest of value outputs a hashed output 114, wherein 
the means lor nxxiifying 1 10 at least one predetermined 
bit of the image block is electrically coupled to the ss 
means for calculating a digest of values 112; a means 
for combining 1 16 the hashed output 114 with a water; 
mark 118, wherein the means for combining 116 the 



hashed output 1 14 with a watermark 118 is electrically 
coupled to the means for calculating a digest of values 
1 12, wherein the output of the means for combining is a 
combined image bkx^k; and a means for inserting 126 
the combined image block (0^) into the modified image 
tMxk Xp wherein the means for inserting 126 the conr^ 
bined image block (0^) into the modified image block Xp 
Is electrically coi4>led to the means for modifying 1 10 at 
least one predetermined bit of the image block. 
[0016] Referring to the flowchart of Figure 1 B, in tiie 
preferred enrtxxllment the method for inserting a water- 
mark into a digital original input image including the 
steps of: partitioning the image block X^ into at least one 
I x J block (step 150); for each I x J block, mocfifying at 
least a predetermined bit of the t>kx:k to a predeter- 
mined value (step 152), wherein the modified image 
bkxik is Xr; cak;ulating a digest of the values using a 
ayptographic hash function (step 154); combining tiie 
hashed output calculated in the prevbus step with a 
watermark bitinap B^ (step 156), wherein the output of 
the step of comtMning the hashed output with a water- 
mark Br is an comtxned image fc>lock Cp and inserting 
the value Cp Into the nnxiified image X^ (step 158). 
[001 7] The steps shown in Rgure 1 B conrespond to 
the Implementation bkxd® shown In Rgure 1A. For 
example, the step of calculating a digest of values (step 
154) corresponds to the implenr^entation block 112 in 
Rgure 1A. In other words, the step of calculating a 
digest of values is perionmed by block 112. Similarly, 
step 152 corresponds to block 110, step 156 corre- 
sponds to bkx;k 116 and step 158 corresponds to block 
126. Alttx>ugh Figure 1 B shows a flowchart of the steps 
in Figure 1A. the block diagram shown In Rgure 1A 
clearly shows the inputs and outputs resulting from 
each step and the sequence of steps. 
[0018] The input to the means for setting a predeter- 
mined bit to a predetermined value is a block of the orig- 
inal input image X^^. In ttie prefen-ed embodiment tiie 
original input image X^ ^ is a gray scale image of size M 
X N, In an altemative enrtxxJiment. tiie original input 
image is color image. In the case of a color image, the 
same technk^ue shown in Rgures 1A. IB, 1C, 2 A, 2B, 
9A. 9B, 10A, and 1 0B can be applied independentiy to 
the color planes of the image, either In the RGB color 
space or in any other color space such as for example, 
YUV. 

[001 9] In ttie preferred emkxxiiment the image X;„ „ is 
partitioned into tslocks of / x J pixels. In one emtxxii- 
ment, the partitioned t)locks in this application the 
b>k>cks descritjed are 8x8, arthough other block sizes 
are possitJe. Further, ttie step of partitioning tiie original 
image into I x J pixel blocks may be eliminated (this is 
equivalent to partitioning the image into one block, tiie 
image block having a block size where l=M and J=N ). 
However, having one btock for the entire image is not 
desirable. Partitioning the original input image helps 
maintain localization when authenticating an image. 
Further, partitioning helps tiie viewer of tiie image more 
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' dearJy see the location where changes in the image 
have occurred. 

[0020] Let affj n be a bi-level Image that represents the 
watermark to be embedded in „ Hot& that a^^n need 
not be of the same size as X^^^. From a^.n we can form s 
another bi-levei image 5^ „ of size M x A/ (same size as 
^m,n)- There are many ways of transforming the image 
„ into an image the same size as X^ „. For example, 
^m,n t>e formed by tiling i.e.. periodically rep- 
licating Bfn n to the desired size. Another possibility is to io 
append all zeros (or all ones) to the boundary of a^ so 
that we obtain b^^ n the desired size. 
[0021] For an original input image X^ ^j partitioned 
Into I X J pixel blocks, let 

15 

be a block of size / x J taken from the image X;„ „. For 
simplicity, we are using a single index r to denote the 
block in the image. The corresponding btock within the 20 
binary image „ for the watermark bitmap 118 is 
denoted 

^r= {^ih-t^i ■ 0^k^i-1;0^t^J-1h 

25 

Note that / and J can be any number provided they sat- 
isfy U^p, where p is the size of the hash function 1 12. 
[0022] The input to the means for modifying 1 10 at 
least one predetermined bit of a image block to a prede- 
termined value is a rth btock of the image X^ In the ao 
prefenred embodimerrt, the bit l>eing set is the LSB of 
the block. Modifying the LSB of the block causes the 
least visible image distortion, an important factor for an 
invisible watemiark. Although the emlxxliment shown in 
Rgure 1A is preferred, other alternative methodologies 35 
for modifying the image block availat)le. However, 
even if atternative methodologies are implemented, it is 
critical that the identical methodology for nrxxJifying the 
image block (means 110. step 152a) in the water- 
mark insertion process must also be used for modifying 40 
the watermarked image block (means 210, step 
252a) for the watermark extraction process shown in 
Figures 2A and 28. 

[0023] In the enrtxxjiment shown in Figure 1A, the 
image block X, is nxxfified by setting the LSB of the 45 
image block to zero. In an alternative embodimerrt of the 
embodiment implemented in step 152, a bit other than 
the LSB (or alternatively a group of bits) may be set to a 
predetermined value. In the embodiment shown in Fig- 
ure 1A. the predetermined value is zero, although the so 
value determined by the system designer may be 
changed. As previously described, although the value of 
the predetemiined value and the bit locatfon of the pre- 
determined bit n^y be changed by the system designer, 
it is critical that the same predetermined bit and prede- 55 
termined value used in the watermark insertion proce- 
dure defined in Figure 1A should also be used in the 
watermark extraction procedure defined in Figures 2A 



and 2B. In other words, if the means for setting a prede- 
termined bit 1 10 of the block of the original input image 
to a predetermined value uses the LSB of the image as 
its predetermined bit and the value zero as its predeter- 
mined value, then the means for setting a predeter- 
mined bit 210 in Rgiffe 2A should use the LSB of the 
image as its predetermined bit and the value zero as its 
predetermined value. 

[0024] Figure 1 C shows various alternatives for nxxl- 
ifying the image block X^. In a first embodiment (as 
shown in Figure 1 A), for each block, a predetermined bit 
of the image block X^ is set to a predetermined value. 
However, in an alternative embodiment, for each block a 
predetermined bit(s) wouW be discarded (step 152b). If 
a predetermined bit(s) is discarded, it is this predeter- 
mined bit(s) that the combined image block Cr is prefer- 
atrfy inserted in. In a third alternative embodiment, the 
image block coukJ be nrxxlrf ied according to a pattern of 
bits (step 152c). If a predetermined btock is modified 
according to a pattem. it is this pattern of bit(s) that the 
combined image btock is preferably inserted in (step 
158). Rgure 1C shows only three possible alternatives 
for modifying the image block X^ Other alternatives for 
modifying the image block X^ are possible. What is criti- 
cal is that the image btock X^ be nrxxiif ied. Preferably, at 
least a portion of the combined image is inserted into 
the modified bits of the mocfif ied image block X^ 
[0025] The output of the means for nxxirfying a prede- 
termined bit of the block of the image block is Xp >Cr is 
input to both the means for calculating a digest of values 
K. M. N )^ using a cryptographic hash functton and a 
means for inserting Cr into a predetennined bit of Xp 
Refenring to Figures 1 A and 1 B. the inputs to the means 
for calculating a digest of values using a cryptographic 
hash tonction are K (user key), Xf (modified image 
block), M (the wkith of the original input), and N (the 
height of the original input block). 
IP026] Referring to Rgures 1 A and 1 B show the step 
of cateulating a digest of the values K. M, N. X^ using a 
cryptographic hash function. The cryptographic hash 
function may be cfwsen from a variety of hash func- 
tions. In the preferred embodiment the well known MD5 
function or a variant thereof is used. The MD5 function 
is described, for example, in the artfole TTie MD5 Mes- 
sage Digest Algorithm." R.L Rivest, Internet RFC 1321, 
April 1992. For the rest of this disclosure, we will use 
MD5 as our hash function although in alternative 
embodiments, other cryptographic has functfons may 
also be used. 

[0027] In the embodiment described by the present 
invention , K is the seaet encryption key, X^ is the nxxl- 
ified original input image block. M is the widtii of the 
original input image, and N is the height of the original 
input image. Consider a cryptographic hash function 

H(S)=(d,. d^, dp) 

where S represents a string of data of arbitrary length, 
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dj'!s are the binary output bits of the hash function, and 
p Is the size of the output bit string. It has the property 
that given an input bit string S and Its corresponding 
output (di ...,dp), it Is computationaliy infeasible to find 
another input bit string of any length that will be hashed 5 
to the same output fc/y dp). Using the MD5 hash 
algorithm, any data string may be hashed into a bit array 
of length 1 28, ie. . p = 1 28. tf another cryptographic func- 
tion is used, the length p may be different. In the pre- 
ferred embodiment, the inequality p^ U is satisfied. 70 
[0028] Let K be a user key consisting of a string of 
bits. In the preferred embodiment, for each block of data 
Xr we form the corresponding block A> where each ele- 
ment in 2(f equals the correspondng element in 
except that the least significant bit is set to zero. We is 
compute for each block the hash 

H(KM,N, X^) = (d'^,d'2 d'p). 

[0029] Then, we select the first IJ bits in the hashed 20 
output and form the rectangular array d^.n of size / x J. 
[0030] The hashed output d ((f^, cf^.,'..., cfp^ and a 
block of the watermarked bitmap Br are inputs into the 
means for combining the hashed output with a water- 
mark. The process for extracting and inserting a water- 25 
mark both include the step of combining the hashed 
output with the watermark Bp The step of combining the 
hashed output 114 with the watermark 1 1 8 is performed 
using a bitwise logical operation. This allows easy 
processing for both the watermark insertion and extrac- 30 
tion processes. In the preferred embodiment and as 
shown In Rgures 1 A and 1 B, the bitwise logical opera- 
tion is an exclusive or function. 
[0031 ] Referring to Rgure 1 A, the hashed output array 
is corTt)ined with to fonn a new binary block Cr using 35 
a pixel by pixel exclusive OR operation. That is, we form 

where ® is the exclusive OR operation, and Cni,n are the 40 
elements in C^pfn^n are the elements in Br and 4 are the 
elements of the hashed output d. 
[0032] In ttie preferred embodiment, the final step 
before the creation of the watermarked image is insert- 
ing the value Cr into the modified image In the mod- 45 
if ied image block at least one bit of the image t>lock 
is set to a predetermined value. Typically. Q is only 
inserted in bits that hiave been modified. Although pref- 
erafc)ly, each bit that has been modified conesponds to 
an insertion bit of Op in an alternative emlxxliment, a bit so 
Cr does not correspond to each nxxlified bit of the 
image bkx^k and therefore a value of Cr is not inserted 
into every modified bit. In the preferred embodiment, 
where the LSB's of the image block are nxxlified to be 
set to zero, and Cr is inserted into the LSB of Xp a value ss 
of Cr is inserted into each nxxlified bit. 
[0033] In the preferred embodiment, we put Cr^ '"to 
the least significant bit of the block X^ to form the output 



bkx:k V;. This procedure is repeated for each bkx:k of 
data, and all the output blocks are assembled 
togetfier to form the watermarked image „. The 
comtNned output bkx:k Cr and the nxxiif ied irr^ge Xr are 
inputs into a means for inserting Cr into a predeter- 
mined bit of The output of the means for inserting Cr 
into a predetermined bit of Xr is the output image block 
The output image block V). is a watermarked image 
bkx^k. 

[0034] Refemng to Rgure 2A shows a ttlock diagram 
200 of the watermark extraction methodology that may 
be used in corrt^ination with the insertion methodology 
shown in Figures 1A and IB. The watermark extraction 
process extracts the watermark Br from the image block 
Yr to retrieve ttie watermark. Refen^ing to Figure 2A, the 
watermark extraction apparatus includes a means for 
nxxiifying at least a predetermined bit to a predeter- 
mined value 210; a means for extracting a predeter- 
mined tk\ from the watermarked Image t)kx;k Yr; a 
means for calculating a digest of values using a crypto- 
graphic hash function, wherein the means for nxxlifying 
a predetermined bit 210 is efectricalty coupled to the 
means for calculating a digest of values 212; and a 
means for combining 216 the hashed output value 214 
witti the extracted image block Ep wherein the means 
for conri)ining 216 ttie hashed output value 214 with ttie 
extracted Image block £^220 is electrically coipled to 
ttie means for extracting 218 a predetermined bit from 
the watenmarked image block Y^. 
[0035] Referring to Rgure 2A and ttie f towchart shown 
in 2B shows a mettiod of extracting a watermark from a 
digital image Yr. including the steps of: for each I x J 
bkx:k. modifying at least a predetermined tMt of ttie 
watermarked image Yr to a predetermined value (step 
252). wherein ttie mocfif ied watermarked image Yr is Yr; 
extracting at least a predetermined bit from ttie water- 
marked image (step 254); calculating a digest of ttie val- 
ues using a cryptographic hash function (step 256); 
combining the hashed output witti the image block Ep 
[0036] Referring to Figure 2A, ttie inputs to the bkx:k 
for calculating a digest of the values K. M, N, Yr using a 
ayptographic hash function are K( the user key), M (ttie 
image widtti of the original image), and N (the image 
height of ttie original Image) and Yr(ttie watermarked 
image bkx;k rrxxlrfied to set a predetermined bit of an 
image ttlock to a predetermined value). Thus, the step 
of modifying a predetermined bit (step 252) of ttie 
watermarked image btock to a predetermined value, 
must be performed before the step of calculating a 
digest of the values (step 256) K, M, N. Yr using a ayp- 
tographic hash function. 

[0037] After we have obtained tfie extracted water- 
mark, the extracted watermark can be compared (visu- 
ally, via a computer image comparison program, etc.) to 
an appropriate watermark. For example, ttie appropri- 
ate watermark nnay be an image tiansmitted to ttie 
receiver at an earlier time for watermark comparison 
purposes. If ttiere is deviation between the two water- 



6 



11 



EP0 953 938 A2 



12 



marks, then the locations of the deviations indicate the 
regions within the watermarked image that have been 
changed. 

[0038] Rgures 3-8 more clearly shows the properties 
exhibited by images created using the watermarking s 
methodology according to Rgures 1A. IB, 2A and 2B. 
For example, Figures 3 and 4 clarify that the watermark- 
ing method described by the present invention imple- 
ments an invisible watermark. Referring to Rgure 3 
shows an original image before the waternwk inser- io 
tion. Rgure 4 shows a watermarked image that has 
been watermarked using the watermark insertion meth- 
odologies described in Rgures 1A and IB. Comparing 
the Figures 4 and 3, it can be seen that the watermark 
produced is an invisit)le watermark since there is no vis- is 
ually observable difference between the two images. 
[0039] Another property clearly exhibited by Rgures 5 
and 6 Is that a correct user key is required for the extrac- 
tion of a proper watermark. If one uses the correct user 
key K and applies the watermark extraction procedure 20 
to Figure 4. one obtains an output image Figure 5. indi- 
cating the presence of a proper watermark. In contrast, 
Rgure 6 shows an output image resembling random 
noise that may occur for example, if an image is 
unmarked, an incorrect key is applied, or the original zs 
image is cropped. If an image is unmarked, i.e., if it does 
not contain a watermark, the watermark extraction pro- 
cedure retums an output that resembles random noise 
as shown in Rgure 6. Similarly, if one applies an irK»r- 
rect key (for example, if one does not know the key), 30 
then the watermark extraction procedire returns an out- 
put that resembles random noise. As another example, 
if a watermarked image is cropped and then one applies 
the watermark extraction procedure on this cropped 
image, the output would resemble random noise. 35 
[0040] Rgure 7 shows the watermarked image of Fig- 
ure 4 that has been modified by the inclusion of a glass. 
Figure 8 shows the extracted watermark from Figure 7 
indicating the specific area where the modification to the 
watermarked image (tf)e adcfition of a glass) have been 40 
made. If or^ changes certain pixels in the watermarked 
image, then the specific locations of the changes are 
reflected at the output of the watermark extraction pro- 
cedure. Figure 7 shows an image where a glass is 
pasted onto Figure 4. Rgure 8 shows the extracted 45 
watermark from Figure 7, indicating the specific area 
where changes have been made. 
[0041] A question that arises is that whether the 
watermark is secure if it is put into the least significant 
bit of the image. Recall that this watermark is designed so 
for authentication purposes, i.e.. to detect any change 
to the image. If someone attempts to remove the water- 
mark by changing some bit planes of the image, the 
watermark extraction procedure will detect the changes. 
[0042] A very important issue is whether it is possit)le ss 
for someone to forge a watermark into the scheme. 
Consider an image t)lock B^. Suppose someone wants 
to alter some or all of the pixels in this image block so 



that it becomes It is necessary that the pixel values 
in the two image tkxks satisfy 

H(K, M, N, B,) = H(K, M, N, B,). 

[0043] That is, the digest generated from kx)th image 
blocks must be identical. This is considered conputa- 
tionatly infeasil)le because of the properties of crypto- 
graphic hash functions such as the MD5 algorithm. 
[0044] In the first embodiment (desaibed and shown 
in Rgures 1A. IB. 1C, 2A. 2B and the accompanying 
text), watermark insertfon and extraction is described 
for a secret key system. A second errtxxiiment 
(described and shown in Figures 9A. 9B, IDA, 10B and 
the accompanying text in the specification) provides 
watermark insertion and extraction for a public key sys- 
tem. 

[0045] Rgure 9A shows a block diagram of an elec- 
tronic system for implementing the insertion of a water- 
mark into an original input digital image for a public key 
system. The btock diagram shown in Rgure 9A is a 
modified version of the system shown in Rgure 1A, 
where the modifkatfons have t>een nnade to include 
public key encryption. Similarly, the bfock diagram 
shown in Rgure 1 0A is a modified version of the system 
shown in Rgure 2A except that the extractfon methodol- 
ogy shown in Rgure IDA has been nrxxiified to include 
put^lic key decryptfon. 

[0046] Except for the nrxxliftcations made for the pur- 
poses of including public key encryption (for example, 
the inputs to the hash function and electrical connec- 
tions have been nxxJified), In general the statements 
made with respect to Figures 1A. IB, 1C can also be 
made with respect to Rgure 9A and 9B. Similarly state- 
ments made with respect to Rgures 2A and 2B apply 
with respect to Figures 10A and 10B. For exarrple. the 
statement made with respect to Rgure 1A. that the 
image bkxk Xr may t>e nrxxJified according to the alter- 
natives sfwwn in Figure 1C. is also true for Rgure 9A 
(the Implementation block 910 may t>e modified accord- 
ing to the alternatives shown in Rgure 1 .) 
[0047] R^re 9A shews a block diagram of the water- 
mark insertion methodology according to a secorxJ 
embodiment that implements a public key system. Rg- 
ure 9B shows a f Icwchart of the steps corresporxiing to 
the insertion methodology shovvn in Figure 9A. Similar 
to the image defined in the first embodiment, for the 
pii)lic key system we assume a grayscale image „ 
having a size of M by N pixels. We want to insert a 
binary invisible Watermark image to „ to obtain 
the watermarked image „. Similar to the first embod- 
iment, watermark insertion and extraction is performed 
on blocks of image data. For convenience, we chose the 
image t3lock size to be 8 by 8. 
[0048] Referring to Figure 9A. the apparatus for inser- 
tion of watermark for a public key system includes: a 
means for rrxxirfying at least a predetermined bit of the 
image block 910; a means for calculating a digest of 
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values using a cryptographic hash function 912, 
wherein the means for calculating a digest of value out- 
puts a hashed output Pf 914, wherein the means for 
nxxjifying 910 at least a predetermined bit of the image 
block is electrically coupled to the means for calculating 5 
a digest of values 912; a means for comtNning 916 the 
hashed output with a watermarK wherein the means iot 
combining 916 the hashed output with a watermark is 
electrically coupled to the means for calculating a digest 
of values 912; a public key encryption means 922 elec- w 
tricaliy coupled to the means for comt)ining 916 the 
hashed output and watermark; and a means for insert- 
ing 926 the encrypted output and watermark (W^) into 
the predetermined bit of the block of the image 2<o 
wherein the means for inserting is electrically cou- 15 
pled to the means for modifying 910 at least a predeter- 
mined bit the image block. 

[0049] Figure 96 shews a fk>wchart of the steps cor- 
responding to the insertion methodology shown in Fig- 
ure 9A. Referring to the fk3wchart of Rgure 9B. the 20 
method for inserting a watermark into a digrtat original 
input image for a public key system includes the steps 
of: partitioning the original image into I x J t)locks 
(step 950); for each I x J bkx;K modifying at least a pre- 
determined bit of the image tiock (step 952). wherein 25 
the nnodif led image is X^; calculating a digest of the val- 
ues using a cryptographic hash function (step 954); 
combining the hashed output calculated in the previous 
step with a watermark B, (step 956), wherein the output 
of the step of combining the hashed output with a water- 30 
mark is a combined image encrypting the com- 
bined image (step 958), wherein the encrypted 
image is Wp and incorporating the value into the 
modified image bkx^ is 

[0050] Similar to the methodology desaibed for water- 35 
mark insertion for a secret k^ system, we let 
denotes the r*^ block of data within the image „. 
Next, a corresporxiing block X^. is formed where each 
element in X,. equals the corresponding element in 
except that a predetermined bMt (the least significant bit) 40 
is s^ to a predetermined value zero. H( • ) be a crypto- 
graphic hash function such as the MD5 algorithm. The 
hash function is computed as follows: 

H(M.N,X^)^(p',,p'2.--,p's) « 

where pfj denotes tiie output bits from the hash func- 
tion, and s is size of the output bits that is dependent on 
the specific hash function used. For example, s =128 for 
MD5. 50 
[0051 1 Denoting the first U bits from the bit stream P^, 
i.e., 



Pr is combined with a corresponding block Bf in t>; 



using a bitwise logic function, typically an exclusive or 
function. That Is, we compute = © where © 
denotes the efement-wise exclusive OR operation 
between the two blocks. Finally we encrypt with a 
public key cryptographic system to give 

where E(*) 'is the encryption function of the public key 
system, and K' is the private key. The tnnary block of 
data is then embedded into the least significant bit of 
the data biock Xr to form a block in the watennarked 
image. 

[0052] Figure 10A shows a block diagram of the 
watermark extraction methodology tiiat is used in com- 
bination with the insertion mettiodology shown in Fig- 
ures 9A and 9B. Figure 10B shows a fk3wcfiart of the 
watermark extraction metiiodology used in Figure 10A. 
The apparatus shown in Figure 10A includes: a means 
for nrxxJifying 1010 at least a predetermined fc>it of a 
bk)ck of the watermarked image to a predeternnined 
value, wherein the modified image block is Z^; a means 
for exta-acting 1018 a predetermined bit from the image 
Z^; a means for calculating a digest of values 1012 using 
a cryptographic hash function, wherein the means for 
nxxJifying 1010 at least a predetermined bit is electri- 
cally coupled to the means for calculating a digest of 
values 1012; a public key decryption means 1020, 
wherein the output of the public key decryption means is 
a decrypted image block Up wherein the pubtlic key 
decryption means 1020 is eledrically coupled to the 
means for extracting 1018; and a means for combining 
1016 the hashed output value with tiie decrypted image 
block Up wherein the means for combining the hashed 
output with the modified image bfock is electrically 
coupled to the public key decryptfon means 1020 arxl 
the means for cakxilating a digest of values 1012. 
[0053] In the extraction procedu^e, the image t>kx^ 
is used to create two different images. In the preferred 
embodiment, the first image contains the least signif- 
rcant bits, and the other image contains tiie pixel val- 
ues except that the least significant bits have been 
zeroed out. We then calculate the hash o\ M, N and Z^, 
and denote ttie f rst U bits of the output by O^.. We use a 
public key decryption algorithm to decrypt with ttie 
public key K that corresponds to tiie private key fC used 
in the watermark insertfon procedure. That is, we calcu- 
late 

Ur=D(G,). 

Finally, we compute the output block O^ - 
using an element-wise exclusive or procedure. 
[0054] In our implementation of tiie public key water- 
mark insertion and extraction procedures, we used the 
MD5 as our hash function, and tiie RSA public key 
encryption algorithm for encryption and decryption. If 
tx>th the watermarked image block and the image size 
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had not been changed since the insertion of a water- 
nfiarK i.e.. if = then = arxJ ^W^.lHs 
implies P^^Qr a«j U^=0^. Hence the output 
binary Image Or. is identical to the block B^. Othenwise, 
this will not be the case and the output t)lock will 5 
appear similar to random noise due to the nature of the 
hash function. As a result. tNs algorithm can detect any 
change to the pixel values to the block level. 
[0055] Rgure 10A shows a block diagram of the 
watermark extraction methodology that is used in conv w 
bination with the insertion methodology shown in Rgure 
9A and 9B. Referring to 1 0B shows a method of extract- 
ing a watermark from a digital image Yp for a public key 
encryption system, including the steps of: for each I x J 
blocK nKxJifying at least a predetermined bit of the is 
watermarked image Zr to a predetermined value (step 
1050), wherein the modified watermarked image is 
Zf\ extracting at least a predetermined t)it from the 
watermarked image 7^ wherein the extracted image 
block (step 1 054) is calculating a digest of the values 20 
using a cryptographic hash function (step 1052); 
decrypting using a put)lic key decryption furx^tion 
D)(( • ), wherein the decrypted image block is 11^; and 
combining the hashed output with the decrypted image 
block Ur. 25 
[0056] Rgure 1 1 shows a summary of the experimen- 
tal results summarizing the properties of the secret key 
veriffcation methodotogy shown in Rgures 1 A, IB. Sinv 
ilarly, Rgure 12 shows a summary of the experimental 
results summarizing the properties of the puljlic key ver- 30 
ification methodology shown in R^res 9A. 9B. Refer- 
ring to Rgures 11 and 12, one way to accomplish 
ownersNp verification is to associate a user key with a 
watermark so that the desired watermark can only be 
extracted from a watermarked image with the appropri- 35 
ate user key. tf the user performs the watermark extrac- 
tion procedure using either an incorrect key or with an 
image that was not watermarked, tiie user obtains an 
image that resembles random noise. 
[0057] The block diagrams and flowcharts shown in 40 
Rgures 1 A. IB. 1C, 2A, 2B, 9A, 9B, 10A, and 10B may 
be implemented in either hardware or in software or a 
combination of both. For example, refen^ing to the t)lock 
diagram in Rgure 1 A. the computation of the hash func- 
tion (calculating a digest of values) could implemented 45 
in software, while the exclusive OR function 1 16 arxi the 
nKxiification of a predetermined bit of the image block 
could be performed in hardware. Alternatively, in 
another embodiment, tiie implementation of the t)lock 
diagram shown in Figure 1A could be implemented so 
entirely in software, wherein the software is stored on a 
computer readable media and is adapted to running on 
a computer system. 

[0058] Figure 13 shews a high-level block diagram of 
a computer system adapted to execute a software pro- ss 
gram implementing the steps of the watermark method- 
ology according to the present invention. Central 
processing unit (CPU) 1311 is coupled to a bus 1312 



which in turn is coupled to random access memory 
(RAM) 1313, read only memory (ROM) 1314. input/out- 
put (I/O) adapter 1315, a comnrunications adapter 
1316, user interface adapter 1317, and display adapter 
1318. RAM 1313 and ROM typically hoW user and sys- 
tem data and programs. Typically, a software program 
implementing the present invention will reside on a stor- 
age medium and will execute on the CPU. 
[0059] It is understood that the atx)v6 description is 
intended to be illustrative arxi not restrictive. For exam- 
ple, the present invention provides watermarking tech- 
nique for embedding a digital identifier into an image 
^m,n c^MxN pixels, to form a watermarked image /^.n 
of ttie same size. In an alternative embodiment, the 
watermarked image is a different size than the image 
^m,n' "The scope of the invention should therefore t>e 
determined with reference to the appended claims, 
along with the full scope of equivalents to which such 
claims are entitied. 

Claims 

1 . An electronic system for inserting a watermark into 
a digital image, corrprising: 

a means for rrxxlifying at least one predeter- 
mined bit in an image block to a predeter- 
mined value, wherein the modified image bkKk 
is Xp 

a means for calculating a digest of values using 
a ayptogr^hic hash function, wherein the out- 
put of the means for cafoulating a digest of val- 
ues is a hashed output, wherein ttie means for 
modifying at least one predetermined bit of the 
image b»lock is electrically coupled to the 
means for calculating a digest of values; 

a means for combining the hashed output with 
a watermark, wherein the means for comtMning 
the hashed output with a watermark is electri- 
cally coupled to the means for calculating a 
digest of values, wherein the output of the 
means for combining is a combined image 
block; and 

a means for inserting a first innage block into 
the rrxxJified image block Xp wherein the 
means for inserting the first image block into 
the nfxxJified image block X^ is electrically cou- 
pled to the means for nrxxlifying at least one 
predetermined btit of the image block. 

2. The electronic system recited in claim 1 wherein the 
first image block is the combined image block Or- 

3. The electronic system recited in claim 1 wherein the 
first image block is an encrypted irr^age block Wp 
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4. ■ TTie electronic system recited in daim 2 wherein the 

nieans for conrt)ining the hashed output with a 
watermark is electrically coupled to the means for 
inserting the first image block into the modified 
image t>k>ck 5 

5. The electronic system recited in daim 1 wherein the 
means for nrxxJifying at least one predetermined bit 
modifies the LSB of the image block Xp 

10 

€. The electronic system recited in daim 1 wherein the 
means for combining the hashed output with a 
watermark is an XOR k)gic block. 

7. The electronic system recited in daim 1 wherein the is 
PDeans for modifying at least a predetermined bit to 

a predetermined value nxxlifies the at least one 
predetermined bit independently for each color 
plane of the image block 

20 

8. The electronic system redted in claim 3 further 
induding an er>cryption means, wherein the 
encryption means is electrically coupled to both the 
nneans for combining the hashed output with a 
watermark and the means for inserting a first image 25 
block into the nxxjif ied image bkxk Xp 

9. An electronic system for extracting a watermark 
from a digital image comprising: 

30 

a means for nrxxjifying at least a predetemiined 
bit of the watermarked image to a predeter- 
mined value; 

means for extracting at least a predetermined ss 
bit from the watermarked image block; 

means for cateulating a digest of values using a 
cryptographic hash function, wherein the out- 
put of the means for calculating a digest of val- 40 
ues using a cryptographic hash function is a 
hashed output, wherein the means for modify- 
ing at least a predetermined bit of the water- 
marked image is electrically coupled to the 
means for calculating a digest of values; and 45 

means for combining, wherein the means 
for combining is electrically coupled to the 
means for calculating a digest of values. 

50 

10. The electronic system recited in daim 9 wherein the 
means for combining is electrically coipled to the 
means for extracting at least a predetermined bit 
from tiie watermarked innage block. 

55 

11. The electronic system redted in claim 9 further 
including a decryption means, wherein the decryp- 
tion means is elecb-icaily coupled to the means for 



extracting at least a predetermined bit from ttie 
watermarked image blod^ and the means for com- 
bining. 

12. The electronic system recited in daim 9 wherein ttie 
means for nxxlitying at least a predelennlned bit to 
a predetermined value nrxxJif ies the least significant 
bit of the image block. 

13. A nf)ethod for inserting a watermark into a digital 
image including the steps of: 

partitioning the image block X^ into at least one 
lxJbk)ck: 

for each I x J block, nxxfifying at least a prede- 
termined bit of each I x J bkxk to a predeter- 
mined value, wherein tiie modified image block 
is X^; 

calculating a digest of the values using a cryp- 
tographic hash function; 

combining the hashed output calculated in the 
previous step witti a watermark bitmap Bp 
wherein the output of tiie step of combining the 
hashed output with a watermark is a com- 
bined image block 0^ arxJ 

inserting a first image bkx:k into the modified 
image X^ 

14. The method redted in daim 13 wherein the first 
image block is the combined image t)iock Gp 

15. The method redted in daim 13 wherein the first 
image block is an encrypted image block Wp 

16. The method recited in daim 13 further including the 
step of encrypting the combined image block, 
wherein the result of encrypting the combined 
image block is the encrypted image block Wp 

17. The method recited in daim 13 wherein the at least 
one predetermined bit of the image biock \ is nrxxl- 
if ied by discarding the predetermined bit. 

18. The method recited in daim 13 wherein ttie step of 
modifying at least one predetermined tHt of ttie 
image block X^ a plurality of bits are modified by set- 
ting the predetermined pattern of bits to predeter- 
mined values. 
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PARTITION IMAGE INTO AT LEAST 
ONE BLOCK OF I X J PIXELS 



MODIFY EACH IMAGE BLOCK X 
MODIFY IMAGE BLOCK IS Xr 



CALCULATE A DIGEST OF VALUES 
K,M.N.Xr USING A 
CRYPTOGRAPHIC HASH 
FUNCTION TO CREATE A HASHED 
OUTPUT 



COMBINE THE HASHED OUTPUT 

WITH THE CORRESPONDING 
BLOCK OF THE WATERMARK Bp' 
THE COMBINED IMAGE BLOCK IS 



INSERT 


THE COMBINED IMAGE 


BLOCK 


Or INTO THE MODIFIED 




BIT(S) OF Xr 



Figure IB 
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Figure 2B 
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FOR EACH I X J PIXEL BLOCK, 
MODIFY AT LEAST A 
PREDETERMINED BIT TO A 
PREDETERMINED VALUE, 
MODIFIED IMAGE IS Xr 







CALCULATE A DIGEST OF VALUES 
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CRYPTOGRAPHIC HASH FUNCTION 
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COMBINED IMAGE BLOCK IS C^ 




r 


ENCRYPT THE COMBINED IMAGE 
BLOCK, ENCRYPTED IMAGE IS Wr 






INSERT W INTO THE MODIFIED 
IMAGE X^ 



Figure 9B 
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FOR EACH I X J BLOCK. MODIFY AT 
LEAST PREDETERMINED BIT OF 
A WATERMARKED IMAGE Zr 
MODIFIED IMAGE IS 



I 



CALCULATE A DIGEST OF VALUES 

HA^» £.,mS'?S..'^ CRYPTOGRAPHIC 
HASH FUNCTION, OUTPUT IS 



1050 



1052 



'^P" |ACH BLOCK. EXTRACT AT 

PREDETERMINED BIT 
FROM THE WATERMARKED IMAGE 
Zr. OUTPUT IS Gf 



1054 



DECRYPT Q USING PUBLIC KEY 
DECRYPTION FUNCTION Du() 
OUTPUT IS Uj. ^ 



COMBINE THE HASHED OUTPUT Q 
WITH THE DECRYPTED IMAGE u/ 
OUTPUT IS Of ^' 



Figure 10 B 
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1058 
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mo. 



1321 
PRINTER 



1324 
NETWORK 




Figure 13 
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